{"data":{"id":"b078642f-e716-47a2-b134-bb129d01a5aa","title":"GHSA-pq6c-vh67-xpm3: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check","summary":"A flaw in n8n (a workflow automation tool) allowed users with certain permissions to access and decrypt credentials (secret login information) that belonged to other projects without proper authorization checks. An attacker could use this to steal sensitive secrets and send them to a server they controlled.","solution":"The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should: restrict n8n instance access to fully trusted users only; audit and revoke any custom global roles carrying Log Streaming scopes (eventBusDestination:create, eventBusDestination:test, etc.), limiting those scopes to fully trusted users only; and review existing Log Streaming event destinations for unexpected webhook URLs and remove any that are not recognized, then rotate any credentials that may have been referenced. Note that these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-pq6c-vh67-xpm3","publishedAt":"2026-09-10T21:07:45.000Z","cveId":"CVE-2026-86993","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0, < 2.37.7 (fixed: 2.37.7)","n8n@>= 2.38.0, < 2.38.2 (fixed: 2.38.2)","n8n@< 1.123.76 (fixed: 1.123.76)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00272,"patchAvailable":true,"disclosureDate":"2026-09-10T21:07:45.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.75,"researchCategory":null,"atlasIds":["AML.T0010"]}}